Identity hygiene errors persist in Google Cloud
Security teams often overlook identity hygiene while relying on agentless snapshots. In Google Cloud, 77% of projects fail to enable multi-factor authentication for OS Login, and 76% do not enable OS Login at all. These gaps leave SSH key management scattered across individual instances. Also, 53% of Google Cloud projects contain over-permissioned service accounts, and 75% of projects still have at least one unused service account active. The August 2026 Cloud Security Index shows that weak IAM controls and missing logging affect 80% to 98% of cloud accounts across all providers.
Weak IAM hygiene remains a universal problem. In AWS, 87% of accounts have S3 buckets that do not enforce HTTPS, and 84% have permissive ingress to sensitive ports via network ACLs. Azure accounts also show significant identity gaps, with 55% of Entra users lacking multi-factor authentication and 67% failing to enable storage account key rotation. Attackers use a single stolen credential to navigate a network despite existing firewall rules.
Agentless scanning limitations and the LiteLLM threat
Relying solely on agentless visibility creates a vulnerability during rapid supply chain attacks. In March 2026, the Team PCP group compromised the build pipeline for LiteLLM, an open-source AI gateway library. This breach hit 434,000 CI/CD pipelines across 2,500 organizations. The SANDCLOCK stealer component harvested SSH keys, cloud credentials, and Kubernetes tokens from process memory. The combination of widespread IAM neglect and the fast-moving AI supply chain attack allows a single compromised package to touch nearly half a million automated pipelines before any human or security professional detects the intrusion. The LiteLLM incident shows how attackers exploit unrotated keys and wide permissions to gain access. The Team PCP group targeted organizations with automated CI/CD workflows. This makes the vulnerability much more dangerous for companies that lack manual oversight of their deployment pipelines.
Security professionals find that visibility tools often fail to catch the full blast radius of a breach. A single compromised package sat on PyPI for approximately 40 minutes, yet it successfully propagated across hundreds of thousands of automated pipelines. This speed makes manual remediation difficult, as average remediation times for midmarket organizations stretch to 35 days. The global average cost of a data breach reached $4.99 million in 2026, which is a 12% increase from the prior year. Does your security stack provide the real-time runtime detection necessary to catch a stealer that scrapes secrets directly from process memory?
Consolidation shifts away from Wiz
Enterprises seek alternatives to Wiz to reduce tool sprawl and manage growing cloud workload pricing. Lacework raised $1.3 billion in November 2021, but the company experienced a growth stall after hiring more than 1,000 staff by March 2022. Aikido ranks first for cost and tool-sprawl reduction because it combines cloud posture with SAST, SCA, secrets, and IaC. Orca provides the closest cloud-first alternative for rapid agentless visibility and broad workload coverage.
| Tool | Primary Benefit |
|---|---|
| Aikido | Best for code-to-cloud consolidation |
| Orca | Best for rapid agentless visibility |
| Prisma Cloud | Best for broad code-to-runtime coverage |
| Microsoft Defender | Best for Azure-centric estates |
Wiz remains a market leader, but security teams must address specific visibility gaps left by agentless workflows. Wiz leads the Tenable Cloud Security comparison 6-1, with an aggregate score of 9.1/10 against Tenable’s 8.4/10. However, budget requirements often force companies to seek lower first-year quotes from other vendors. Pricing comparisons must use the same workload, cloud-account, developer, module, data-retention and support assumptions. You should confirm the exact cloud, workload, and compliance modules required before you replace your existing deployment. For enterprises with substantial Azure, Microsoft Defender, Sentinel, and Entra investments, Microsoft Defender for Cloud provides native integration that reduces the need for separate platforms. Organizations often choose Wiz for speed, but they must validate developer workflows outside of the Microsoft ecosystem if they switch to Defender.
